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Our Ref.: B10/21C 
19 July 2019 


The Chief Executive 
All Stored Value Facility Licensees 


Dear Sir/Madam, 


Stored Value Facility Sector: Money Laundering and Terrorist Financing Risk 
Assessment Report (Report) 


I am writing to share the captioned report prepared by the Hong Kong Monetary 
Authority (HKMA), which updates the money laundering and terrorist financing 
(ML/TF) risk assessment for the stored value facility (SVF) sector’. The Report 
includes analysis of threats and vulnerabilities as well as areas for further actions. 


The latest assessment confirms that, based on business operating data and inputs by 
SVF licensees, typologies and analysis by the Joint Financial Intelligence Unit as 
well as supervisory observations from the first two years since the commencement of 
the licensing and regulatory regime, the SVF sector continues to carry a medium 
level of ML/TF risk. It is noted that while the majority of the SVF sector 
continues to be characterised by lower ML/TF risks as determined by small stored 
value, limited functionality and predominant use for transport and low-value retail 
transactions, pockets of higher ML/TF risks have emerged. These include some 
SVF products with functions such as overseas cash withdrawal, cross-border 
remittance and person-to-person fund transfers, which may introduce higher 
vulnerability for illicit fund flows. The findings and conclusions in the Report are 
consistent with those for other jurisdictions. 


The HKMA has been, and will continue to be, working closely with other competent 
authorities as well as SVF licensees to address the identified ML/TF risks in the 
sector. These efforts include, among others, further enhancing the regulatory 
framework and thus resilience of the SVF sector to ML/TF risks, while maintaining 
the functionality aimed at customer convenience and ease of use; strengthening SVF 
licensees’ understanding of ML/TF threats; supporting innovative means by which 
SVF licensees implement financial crime controls effectively and exploring the 
greater use of technology and analytical tools in supervisory work. 


1 Please also refer to the HKMA’s circular on Hong Kong Money Laundering and Terrorist 
Financing Risk Assessment Report issued to SVF licensees on 2 May 2018. 
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The assessment and recommendations in the Report are being incorporated 
holistically into an enhanced framework of SVF account management, which aims to 
manage various risks including, among others, ML/TF risk. Amendments will also 
be made as appropriate to the Guideline on Anti-Money Laundering and 
Counter-Financing of Terrorism (For Stored Value Facility Licensees), on which the 
industry will be consulted in due course. 


SVF licensees should study the Report carefully, consider the relevant insights and 
implications, and review and update where appropriate institutional ML/TF risk 
assessments accordingly. Implementing a risk-based and proportionate approach to 
anti-money laundering and counter-financing of terrorism work relies upon good 
understanding of the ML/TF threats, vulnerabilities and risks, and targeting 
resources and activities at areas of higher risks. 


If you have any questions regarding this letter, please contact Mr Dixon Lam at 
2878-8721 or aml@hkma.iclnet.hk. 


Yours sincerely, 


Carmen Chu 


Executive Director (Enforcement and AML) 


c.c.: Financial Services and the Treasury Bureau (Attn.: Ms Eureka Cheung) 


Encl. 
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Overview 


1. This assessment by the Hong Kong Monetary Authority (HKMA) focuses 
on money laundering and terrorist financing (ML/TF) risks of the stored 
value facility (SVF) sector in Hong Kong and provides an overall risk rating 
for the sector. Using the latest data and analysis provided by the 
industry’ and the Joint Financial Intelligence Unit (JFIU)?, the HKMA 
updated its work done as part of the overall Hong Kong ML/TF risk 
assessment’. 


2. Since the commencement of the licensing and regulatory regime for the 
SVF sector in 2016*, there has been significant growth in the number of 
SVF accounts, transaction volume and transaction value. SVF licensees 
provide services including prepaid cards as well as mobile and internet 
payments, and have actively rolled out different services and expanded 
business networks over the past two years domestically, and cross-border 
in some cases, to enhance customer choice and experience. 


3. The assessment considers the risks of SVF products with different 
functionalities, taking into account risk mitigating measures implemented 
by different SVF licensees. Analysis of available data after two years of 
operation confirmed that the majority of the SVF sector remains 
characterised by lower risks as determined by small stored value, limited 
functionality and predominant use for transport and low-value retail 
transactions, while also revealing pockets of higher ML/TF risks in certain 
products. In particular, risks are emerging in such functions as overseas 


The HKMA updates its understanding of institutional, sectoral and territory-wide ML/TF 
risks on an ongoing basis using a variety of information. For example, each SVF licensee 
is required to submit its institutional risk assessment on a regular basis, as well as 
completing a financial crime data return and an information collection template of customer 
and transaction figures bi-annually. 

Including typologies and analysis on SVF developed by the JFIU and shared with the 
HKMA as inputs to this risk assessment. 

The Hong Kong Money Laundering and Terrorist Financing Risk Assessment Report (Hong 
Kong ML/TF Risk Assessment) was published by the Government in April 2018 and can be 
found at https://www.fstb.gov.hk/fsb/aml/en/risk-assessment.htm. 

Under the Payment Systems and Stored Values Facilities Ordinance, Cap. 584 (the 
PSSVFO) which can be found at https://www.elegislation.gov.hk/hk/cap584 and the 
Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Stored Value 
Facility Licensees) (AML Guideline for SVF licensees) which can be found at 
https ://Awww.hkma.gov.hk/media/eng/doc/key-functions/finanical-infrastructure/infrastructur 
e/svf/Guideline_on_AMLCFT_for_SVF_eng_final.pdf. 
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cash withdrawal, cross-border remittance and person-to-person (P2P) 
fund transfers, which may introduce higher vulnerability for abuse. 


While the latest analysis confirms that limitations on product functionalities 
and thresholds applied as a result of the regulatory regime introduced by 
the HKMA in 2016 have reduced the overall vulnerability, there is a need, 
in view of the growth of the sector and developments in the international 
regulatory landscape as well as emerging ML/TF risks, to update the 
application of the risk-based approach for anti-money laundering and 
counter-financing of terrorism (AML/CFT) work of the SVF sector. 


The findings and recommendations in this report are being incorporated 
holistically into an enhanced framework of SVF account management, 
which aims to manage various risks including, among others, ML/TF risk. 
Appropriate enhancement to the regulatory framework will help reduce 
identified vulnerabilities and the overall risk of the SVF sector, particularly 
as related to overseas cash withdrawal, cross-border remittance, P2P fund 
transfers and impersonation risk, while maintaining the functionality aimed 
at customer convenience and ease of use. 


Taking into account all of these developments, the analysis confirms that 
the SVF sector continues to have a medium level of ML/TF risk’, 
comprising a medium level of threat and medium level of vulnerability, 
which is in line with the risks presented by SVF sectors internationally. 


Development of the SVF Sector 


7. At the end of December 2018, there were 16 SVF licensees offering 


5 


products and services which mostly focus on the Hong Kong market. 
Thirteen® of these were granted licences under the PSSVFO in 2016 and 


A ML/TF risk assessment of the SVF sector was first carried out as part of the Hong Kong 
ML/TF Risk Assessment, based on only and limited operating data available for the sector 
in2017. That assessment concluded that the SVF sector had a medium level of risk. 

List of SVF licensees: (1) Octopus Cards Limited, (2) HKT Payment Limited, (3) TNG (Asia) 
Limited, (4) Alipay Financial Services (HK) Limited, (5) WeChat Pay Hong Kong Limited, (6) 
Optal Asia Limited, (7) K & R International Limited, (8) PayPal Hong Kong Limited, (9) 
UniCard Solution Limited, (10) 33 Financial Services Limited, (11) ePaylinks Technology 
Co., Limited, (12) Autotoll Limited and (13) Transforex (Hong Kong) Investment Consulting 
Co., Limited. 
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the remaining three are licensed banks’. Two more licences were 
granted to the SVF licensees? in May 2019. 


By the end of 2018, the total number of SVF accounts was 56.1 million, a 
20% increase from 46.7 million accounts at the end of 2017 (Chart 1). 
Compared with the local population, this figure suggests that many 
customers have opened accounts with more than one SVF licensee. 


Chart 1: Total number of SVF accounts ('000) 
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9. The total value of SVF transactions was HK$192 billion in 2018°. The 
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figure for H2/2018 increased by 44% to HK$106 billion as compared with 
HK$73 billion in H2/2017. The total value of SVF transactions with 
breakdown by usage types is shown in Chart 2: 


A licensed bank is regarded as being granted a license pursuant to section 8G of the 
PSSVFO. Licensed banks issuing SVFs are: (1) The Hongkong and Shanghai Banking 
Corporation Limited, (2) Dah Sing Bank, Limited and (3) Bank of Communications (Hong 
Kong) Limited. 

(1) Yintran Group Holdings Limited and (2) Geoswift Cards Services Limited have not yet 
commenced business as of end-May 2019. 

For the purpose of this risk assessment, the total value of SVF transactions includes 
payments for goods and services, P2P fund transfers, fund transfers to customer’s own 
bank accounts, remittance, cash withdrawal, etc., which were submitted by SVF licensees 
based on its internal classification. 
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ML/TF Threats in the SVF Sector 


10. Qualitative and quantitative analysis has been conducted regarding the 


nature and extent of observed suspicion or suspected criminal activity 
associated with the SVF sector, based on supervisory observations of the 
HKMA as well as data and inputs from the JFIU and SVF licensees. 
Regarding the extent of activity as shown by JFIU statistics, SVF licensees 
filed around 1,200 suspicious transaction reports (STRs) from November 
2016 to December 2018. In 2018, SVF licensees filed around 530 STRs, 
representing 0.7% of total STRs received by the JFIU and which was 
slightly below the number of STRs filed by each of the securities, 
insurance and money service operator sectors. There was an increase of 
over 110% in STRs between H2/2017 (around 140 STRs) and H2/2018 
(around 300 STRs), which is in line with business growth. 


. Analysis has been made on the nature of observed suspicion or suspected 


criminal activity in the sector and various key typologies have been 
highlighted, particularly based on analysis by the JFIU, including the use of 
SVFs to purchase illegal goods online, the use of SVFs in illegal 
bookmaking and gambling activities, as well as various activities for money 
laundering (ML), notably through the use of SVFs for cash withdrawal at 
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overseas automated teller machines (ATMs). 


. The HKMA has also performed quantitative and qualitative analysis based 
on information collected from SVF licensees, such as risk assessments, 
financial crime risk data including material related to STRs as well as 
engagement and experience sharing in discussion forums with the 
industry". While it is not always possible for SVF licensees to identify the 
precise nature of the suspected criminal threat or activity giving rise to the 
suspicion, where possible SVF licensees have sought to analyse and 
understand the nature of the criminal activity or predicate offence to 
improve risk understanding. 


Based on SVF licensees’ own interpretation and understanding of 
suspicious activities, approximately one-third of STRs were considered to 
be possibly related to suspected fraud. This observation is generally 
consistent with the Hong Kong ML/TF Risk Assessment where fraud is 
identified as by far the most prevalent predicate offence for ML. An 
increase in suspected online gambling and illegal bookmaking was 
observed in 2018, which was also reflected in a typology recently shared 
by the JFIU. In addition, a few STRs were considered by the filing SVF 
licensees to be possibly related to suspected unlicensed money services 
business, drug trafficking or smuggling activities. While ML is another 
major type of suspicion suggested in STRs, some SVF licensees may 
have adopted a highly cautious approach in regarding transaction of large 
amounts as suspicious for ML-related activities. 


According to analysis of industry data, around 85% of STRs made in 
H2/2018 were related to accounts where due diligence had been 
conducted, while the remaining 15% involved SVF products subject to 
customer due diligence (CDD) exemption''. Whilst there are more than 
40 million SVF accounts which are exempt from CDD, only a few tens of 
STRs (out of a total of around 300 STRs) were filed on such accounts in 
H2/2018 reflecting the comparatively lower risk of these products with 


For example, a workshop was held with industry representatives on 24 October 2018 
where the threats and vulnerabilities of SVF sector were discussed. 

Subject to specific requirements on stored value, transaction limit and functionality of SVF 
product as stipulated in the AML Guideline for SVF licensees, there is no requirement to 
conduct CDD on the customer under certain scenarios. 
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15. 


16. 


small stored value and limited functionality under the regulatory 
requirements. 


In sum, based on analysis of the nature and extent of suspected criminal 
activities, the threat to the SVF sector is assessed to be medium and 
concentrated in: 


(a) network-based SVFs being exploited for various fraud-related 
activities; 

(b) prepaid cards being loaded from opaque funding sources and 
misused for cash withdrawal in higher risk countries; and 

(c) P2P functionality being abused for illegal bookmaking activities. 


Overseas experience suggests that SVF products may also have 
vulnerabilities that make them attractive for use in terrorist financing. 
While there has been no indication of such abuse to date in Hong Kong, 
the risk has been noted and generally reflected in SVF licensees’ 
AML/CFT systems and controls, including screening systems. 


ML/TF Vulnerabilities in the SVF Sector 


17 


18. 


12 
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. The features of individual SVF products offered by the SVF licensees"? 


vary to some degree, so that no two products share exactly the same 
vulnerabilities. 


The SVF market is generally characterised by lower risk transactions. 
Purchases of goods and services accounted for about 62% of total value 
of transactions in 2018. The average transaction amount is HK$20, 
which carries low ML/TF risks (see Chart 3). For example, Octopus cards, 
which accounted for more than half of total value of payments for goods 
and services of the SVF sector in 2018, have been demonstrated to be 
low-risk given their low maximum stored value, small average transaction 
amount, and the fact that they are almost exclusively used for transport 
and low-value retail transactions within Hong Kong'®. Products with CDD 


Including 13 SVF licensees and 3 licensed banks (which are regarded as being granted a 
licence under the PSSVFO) issuing SVF products as of end-December 2018. 
Octopus cards can be used at some outlets in Macau and Shenzhen. 
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exemption accounted for about 80% of total SVF accounts, of which 
around 80% are Octopus cards. 


Chart 3: Total value of transactions by customer activities (2018) 
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19. About 24% of the total value of transactions represents fund transfers to 
customers’ own bank accounts, which is in line with the observation that 
many customers may have topped up their e-wallets by credit cards to 
maximise spending and points awards and subsequently transfer the 
funds from e-wallets back to their bank accounts. Besides, merchants 
will also have business needs to transfer the sale proceeds of goods and 
services back to their own bank accounts. Fund transfers between 
accounts of the same person or entity generally carry lower ML/TF risks. 


20. Therefore, of the total value of transactions in the sector, 86%'* presents 
low ML/TF risks, added to the fact that functionalities limit the 
attractiveness for exploitation for ML/TF. The remaining 14% of the total 
value of transactions are related to products and services that may present 
higher vulnerabilities for ML/TF. These include P2P fund transfers via 
e-wallets (11% of total value of transactions in 2018), while further analysis 
suggests that the average amount of such transfers is relatively low at 
HK$378. Cross-border remittance services (2.6% of total value of 
transactions) offered by some SVF licensees, as well as SVF products 
such as prepaid cards with cash withdrawal functions (0.4% of total value 


14 Consists of value of transactions of (i) purchases of goods and services (62%); and (ii) fund 
transfers to customers’ own bank accounts (24%), which generally carry lower ML/TF risk. 
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23. 
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of transactions), may also be vulnerable to being abused. 


P2P fund transfer, a function mainly provided by e-wallets, exhibited rapid 
growth in both number and value of transactions, by around 700% and 
500% from H2/2017 to H2/2018 respectively. Such functionality is 
observed to have become common over the last two years for Hong Kong 
residents, who use e-wallets to conduct small-value P2P fund transfers 
among peers, e.g. splitting the bill for meals. Internationally, as it is in the 
case of Hong Kong, P2P fund transfer is more vulnerable to abuse, as 
there is no underlying purchase or other identifiable reason for a 
transaction, while the average transaction value is still relatively low at 
HK$378 in the current stage of development in Hong Kong. 


. Remittance services provided by SVF licensees increased by 24% from 


H2/2017 to H2/2018, mainly due to strong demand for remittance services 
from foreign domestic helpers. Currently, three SVF licensees provide 
remittance services in Hong Kong and processed about HK$5 billion in 
remittance transactions in 2018. While remittance generally carries 
higher risks given the instant and cross-border nature of fund transfers, 
most of the remittances executed by SVF licensees were noted to be 
initiated by foreign domestic helpers and sent to the Philippines and 
Indonesia, with a low average amount of HK$1,157 per transaction. This 
is commensurate with the population of foreign domestic helpers working 
in Hong Kong, most of whom are from these two countries. 


Cash withdrawal increased by more than 190% from H2/2017 to H2/2018. 
More than 60% was withdrawn in Hong Kong at SVF licensee’s dedicated 
service points (e.g. convenience stores) or ATMs, while the remainder was 
cash withdrawal in other jurisdictions via ATMs using prepaid cards. The 
functionality of cash withdrawal through ATM networks is recognised as 
potentially increasing the level of ML/TF risk as it may allow funding in 
Hong Kong and cash withdrawals in other jurisdictions, including higher 
risk jurisdictions. 


. The design by SVF licensees of CDD exempt products was guided by the 


thresholds as set out in the regulatory framework (e.g. maximum stored 
value of HK$3,000, no cash withdrawal, no cross-institutional or 
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25. 


cross-border fund transfers) which help reduce vulnerabilities. For 
higher-risk products, SVF licensees generally adopted proportionate 
control measures, such as limiting the ability to transfer funds to within the 
provider network and setting transactional limits per customer, to 
commensurate with and mitigate the risks concerned. The relatively 
small market segment offering higher-risk products and services also 
helps limit the overall risk of the SVF sector, albeit the size of the entire 
market is growing. 


While most of the SVF sector is of low risk, there is rapid development in 
P2P fund transfers and remittance as well as the offering of prepaid cards 
with high stored values and overseas cash withdrawal function, and the 
SVF sector is assessed to have an average medium level of vulnerability 
to ML/TF. 


AML/CFT Policies, Procedures and Controls (collectively 
referred to as “AML/CFT Systems”) of SVF Sector 


26. 


27. 


An assessment of the AML/CFT Systems, which manage and mitigate 
relevant risk, is also important to facilitate understanding of the overall 
vulnerability of the SVF sector. The analysis was based on the HKMA’s 
supervisory engagement with SVF licensees including issuance of 
guidance, e.g. Guideline on Anti-Money Laundering and 
Counter-Financing of Terrorism (For Stored Value Facility Licensees), 
conducting on-site examinations and off-site reviews, meeting with SVF 
licensees’ senior management and board of directors, maintaining regular 
industry engagement through AML/CFT forums and collecting periodic 
financial crime risk data. 


According to the HKMA’s supervisory observations, SVF licensees have 
generally put in place AML/CFT Systems commensurate with their ML/TF 
risks, but the effectiveness of implementation varies considerably. Larger 
SVF licensees generally have more sophisticated AML/CFT systems with 
higher levels of relevant experience resulting in more effective risk-based 
approach. Where weaknesses are found in any AML/CFT Systems, the 
SVF licensees concerned would be required to take prompt remedial 
measures as appropriate. The HKMA also shares key issues and good 
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practices with the industry, through various forums and ongoing 
supervisory communications, to facilitate SVF licensees’ understanding of 
risks and strengthen their AML/CFT Systems. 


Next Steps 


28. In view of the updated assessment of ML/TF risks in the SVF sector, the 
HKMA has identified a number of areas for further action: 


(a) Enhancing the regulatory framework and thus the resilience of the 
SVF sector to ML/TF risks, among other risk areas, while maintaining 
functionality aimed at customer convenience and ease of use; 


Strengthening further understanding of ML/TF risks, by monitoring 
new typologies and addressing any information gaps. This will be 
achieved through ongoing cooperation with law enforcement agencies 
and other financial regulators; 


© 
~~ 


Continuing risk-based supervision, including thematic reviews and 
industry training, to focus on areas of higher ML/TF risk and target 
effectiveness of AML/CFT Systems; 


© 
— 


Strengthening the partnership with the SVF sector through 
engagement and guidance to enhance understanding and mitigation 
of risks by the licensees; 


2 


(e) Furthering cooperation with regulatory authorities in other jurisdictions, 
in particular Mainland China, in view of the increasing cross-border 
usage of SVF products and services; and 


(f) Supporting innovative means by which SVF licensees implement 


financial crime controls effectively and exploring the greater use of 
technology and analytical tools in supervisory work. 
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